refactor(layout): role contracts move to roles/ - root is bootstrap-only

Owner direction: the repository root holds first-class, bootstrap-required
configuration only. conductor-policy.json is a ROLE contract (the
conductor's authority), one of scores of future role contracts
(agent-policy, coder-policy, ...) - such files get a dedicated home.

- roles/conductor-policy.json (git mv)
- conductor-apply.sh + test-conductor.sh read the new path
- CONDUCTOR.md records the roles/ convention

Closes UX follow-up from owner layout review; no issue (convention change).

roles/conductor-policy.json

@@ -0,0 +1,19 @@
+{
+  "policyVersion": 1,
+  "autoApply": {
+    "enabled": true,
+    "allowedPaths": [
+      "scripts/**",
+      "docs/**",
+      "tasks/**",
+      "missions/**",
+      "adapters/**",
+      "README.md"
+    ],
+    "suites": [
+      "test-config",
+      "test-task",
+      "test-release"
+    ]
+  }
+}